After 30 years in the computer industry, I have come to the conclusion that most people do not really appreciate how prolific and dangerous the personal information databases are. With a very few exceptions, there are few laws protecting that information. Insurance companies are free to sell that information to anyone they wish.... and some do.
The federal government now requires that any organization with personal information must have a published privacy policy. But in fact, that is absolutely useless because all they need to do to change the policy is publish a new one. Consumers that provide information, willingly or not, have no recourse when that happens.
As an example, I used to purchase a lot of books from Amazon.com. Amazon had a published privacy policy that said they would not share your information with anyone. One day they changed their business model to partner with other firms and begin selling things other than books (like cookware, etc). They published a new policy saying that they would share your personal information with their business partners. So Amazon gave all of their business partners my CC numbers, spending habits, and lists of the kind of books I bought. As the consumer, I had no recourse. Now, I will not buy anything from Amazon, nor any company that advertises that they are partnered with Amazon.
Another example, a couple of years ago, during the dot.com bust, there was one company in California that was in bancrupcy and the only thing left of value was their customer database. There was a big legal battle because the creditors were trying to sell it for maximum value. while some of the customers were trying to protect their info.
Given your SS number and a day or two, I can find out an awful lot of information about you... including what autos you drive, where you bank, where your kids live, etc, etc. am just very protective of private information because once you provide it, you have no control over where it goes.